{"id":"CVE-2026-124057","published":"2026-11-07T18:17:21.607","lastModified":"2026-11-11T05:19:35.813","description":"A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiMultipleConfig-3f953a41781f800fab65eaa6a2887fa1?source=copy_link","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-124057","tags":[]},{"url":"https://vuldb.com/submit/1033754","tags":[]},{"url":"https://vuldb.com/vuln/432112","tags":[]},{"url":"https://vuldb.com/vuln/432112/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow vulnerability exists in the setWiFiMultipleConfig function of the TOTOLINK CA300-PoE device's CGI endpoint, triggered by manipulation of the Key1Str1 argument, allowing remote attackers to overwrite memory and potentially execute arbitrary code. This is a critical flaw due to high impact on confidentiality, integrity, and availability.","exploitability":"Exploitation requires high privileges (PR:H) and remote access to the vulnerable CGI endpoint, but the exploit has been publicly released, lowering practical difficulty for authenticated attackers.","blast_radius":"Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and device denial-of-service, affecting network infrastructure relying on this device.","remediation":"Upgrade to firmware version 6.2c.885 or later, as the vendor has released a patched version addressing this buffer overflow in the setWiFiMultipleConfig function.","detection":"Defenders should monitor /cgi-bin/cstecgi.cgi access logs for unusually long Key1Str1 parameter values exceeding expected length limits (e.g., >256 bytes), especially when accompanied by HTTP 500 errors or unexpected device restarts. No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","cgi","rce","embedded","iot"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:47:31.034Z"}}